[bab]

Hi, was recomended to you by family member. My web browser has been hijacked and my desktop has a open web page displaying a spyware message that i cant remove. I can remove it from the desktop options screen but it always re appears after boot up. Also keep getting a warning on the windows tray saying i should click here to download latest spyware. Of course I wont! Went through all your steps and still keeps comming back. I have however stopped the pop ups. But web browser is still be redirected and desktop picuture wont go away. I hope you can help me! Thanks.

Hijack This Log file:

Logfile of HijackThis v1.99.1
Scan saved at 2:02:58 PM, on 12/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\WINDOWS\system32\popcorn72.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\LCDC\LCDC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\dlbxcoms.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\GothAdmin01\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\system32\msblank.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\GOTHAD~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {D410C6C0-F06E-4937-8B8A-97856F225AF9} - C:\WINDOWS\system32\gobi.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\system32\popcorn72.exe rundll.dll,LoadMouseProfile
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [alij] C:\WINDOWS\system32\run894.exe dummy
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Startup: LCDC.lnk = C:\Program Files\LCDC\LCDC.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://supportcenter...ad/tgctlins.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative....009/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_2.1.1.74.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish....fishActivia.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://costco.intern...x/PCAXSetup.cab?
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15010/CTPID.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: dlbx_device - Dell - C:\WINDOWS\system32\dlbxcoms.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Advertisements]

Hello bab and welcome to Geeks to Go! My name is Steamhead and I am currently reviewing your log. Thanks for the patience!

[Steamhead]

Hello bab and welcome to Geeks to Go! My name is Steamhead and I am currently reviewing your log. Thanks for the patience!

[bab]

Thanks for getting back to me. Hope you can help me out. Here is the most recent HJT log file:

Logfile of HijackThis v1.99.1
Scan saved at 8:34:29 AM, on 12/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\WINDOWS\system32\dlbxcoms.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\LCDC\LCDC.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\GothAdmin01\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {D410C6C0-F06E-4937-8B8A-97856F225AF9} - C:\WINDOWS\system32\gobi.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [alij] C:\WINDOWS\system32\run851.exe dummy
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\Common Files\PestPatrol\ppclean.exe" "clean" "cws" "2"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Startup: LCDC.lnk = C:\Program Files\LCDC\LCDC.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://supportcenter...ad/tgctlins.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative....009/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_2.1.1.74.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish....fishActivia.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://costco.intern...x/PCAXSetup.cab?
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15010/CTPID.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: dlbx_device - Dell - C:\WINDOWS\system32\dlbxcoms.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Steamhead]

Hello bab,

You have a pretty decent infection here. Have no fear, though, because we CAN fix it!
You may want to print this out, that way you will have a hard copy with you at all times.
Let's get started!

STEP 1:

You have a CoolWebSearch infection.

Download CWShredder here to its own folder.

Update CWShredder

* Open CWShredder and click I AGREE
* Click Check For Update
* Close CWShredder

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about. Reboot your computer into normal windows.

STEP 2:

Please open HijackThis! and scan your computer. Place a check next to the following.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: (no name) - {D410C6C0-F06E-4937-8B8A-97856F225AF9} - C:\WINDOWS\system32\gobi.dll (file missing)
O4 - HKLM\..\Run: [alij] C:\WINDOWS\system32\run851.exe dummy
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe *there should be 2 of these*
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab

Now close all windows and browsers, except for HijackThis, and click on "Fix Checked"
Close Hijackthis.

STEP 3:

Reboot into Safe Mode. To do this, restart your computer and tap F8 as it is starting up, then select Safe Mode from the menu and press Enter.

Open Explorer via right clicking on Start then clicking on Explore.
Find and delete the following files in RED:

C:\WINDOWS\system32\run851.exe
C:\WINDOWS\System32\spoolsrv32.exe
C:\WINDOWS\system32\gobi.dll

Now reboot normally.

STEP 4:

Then, please run this online virus scan: ActiveScan

Copy the results of the ActiveScan and paste them here along with a new HiJackThis log

Thanks!

[bab]

Thank you for getting back to me. Your a miracle worker. Looks like my desktop is back to normal. Also, I could not find the file C:WINDOWS\system32\gobi.dll. Active scan detected virus and spyware? Here are the files you requested.

Active Scan:


Incident Status Location

Adware:adware/dloader Not disinfected C:\WINDOWS\SYSTEM32\msblank.html
Adware:adware/topspyware Not disinfected C:\WINDOWS\SYSTEM32\srpcsrv32.dll
Adware:adware/savenow Not disinfected Windows Registry
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip[Gummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-1fbc98e-2f6e2d90.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3f501a45-796c5803.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-792a4b01-48a62f81.zip[Dummy.class]
Adware:Adware/EShopper Not disinfected C:\Program Files\EA GAMES\Battlefield Vietnam\Uninstaller.exe
Adware:Adware/WinHound Not disinfected C:\RECYCLER\S-1-5-21-1292428093-1957994488-725345543-1003\Dc2.exe
Adware:Adware/TopSpyware Not disinfected C:\RECYCLER\S-1-5-21-1292428093-1957994488-725345543-1003\Dc3.exe
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr101.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr130.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr131.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr141.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr163.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr17.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr201.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr223.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr234.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr272.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr292.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr305.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr322.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr324.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr335.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr336.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr345.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr354.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr377.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr39.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr406.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr413.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr429.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr446.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr46.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr486.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr517.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr56.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr568.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr574.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr589.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr608.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr619.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr630.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr662.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr670.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr730.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr731.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr755.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr76.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr763.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr785.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr796.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr815.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr834.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr862.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr865.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr895.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr897.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr905.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr915.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr927.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr975.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr98.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr996.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\run894.exe
Adware:Adware/TopSpyware Not disinfected C:\WINDOWS\system32\srpcsrv32.dll
Adware:Adware/TopSpyware Not disinfected C:\WINDOWS\system32\txfdb32.dll
Adware:Adware/Startpage.AEX Not disinfected C:\WINDOWS\system32\upd282.exe
Adware:Adware/TopSpyware Not disinfected C:\WINDOWS\system32\upd329.exe
Adware:Adware/Adsmart Not disinfected C:\WINDOWS\system32\upd779.exe
HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:49:02 PM, on 12/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\dlbxcoms.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\LCDC\LCDC.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\GothAdmin01\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: LCDC.lnk = C:\Program Files\LCDC\LCDC.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://supportcenter...ad/tgctlins.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative....009/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_2.1.1.74.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish....fishActivia.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://costco.intern...x/PCAXSetup.cab?
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15010/CTPID.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: dlbx_device - Dell - C:\WINDOWS\system32\dlbxcoms.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Steamhead]

Hello bab,

You may want to print this out.

Download and install CleanUp!

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

Click OK

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.


Run Ewido:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.
• You will need to step through the process of cleaning files one-by-one.
• If ewido detects a file you KNOW to be legitimate, select none as the action.
• DO NOT select "Perform action on all infections"
• If you are unsure of any entry found select none for now.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop

Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut.
- Once you are on the Panda site click the Scan your PC button
- A new window will open...click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
- When download is complete, click on Local Disks to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply.
Let us know if any problems persist.

[bab]

There were som files I wasnt sure what to do with during the Ewido scan so I clicked Ignore.

Here are the requested files:

Panda Active Scan:


Incident Status Location

Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip[Gummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-1fbc98e-2f6e2d90.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3f501a45-796c5803.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-792a4b01-48a62f81.zip[Dummy.class]
Adware:Adware/EShopper Not disinfected C:\Program Files\EA GAMES\Battlefield Vietnam\Uninstaller.exe
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr101.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr130.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr131.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr141.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr163.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr17.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr201.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr223.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr234.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr272.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr292.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr305.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr322.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr324.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr335.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr336.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr345.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr354.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr377.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr39.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr406.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr413.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr429.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr446.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr46.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr486.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr517.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr56.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr568.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr574.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr589.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr608.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr619.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr630.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr662.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr670.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr730.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr731.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr755.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr76.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr763.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr785.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr796.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr815.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr834.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr862.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr865.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr895.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr897.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr905.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr915.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr927.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr975.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr98.dll
Adware:Adware/WinHound Not disinfected C:\WINDOWS\system32\ldr996.dll
Adware:adware/dloader Not disinfected C:\WINDOWS\system32\msblank.html

HJT File:

Logfile of HijackThis v1.99.1
Scan saved at 10:55:02 AM, on 12/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\dlbxcoms.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\LCDC\LCDC.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\GothAdmin01\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: LCDC.lnk = C:\Program Files\LCDC\LCDC.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://supportcenter...ad/tgctlins.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative....009/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_2.1.1.74.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish....fishActivia.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://costco.intern...x/PCAXSetup.cab?
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15010/CTPID.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: dlbx_device - Dell - C:\WINDOWS\system32\dlbxcoms.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


smitfiles.txt:


smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: Sat 12/17/2005
The current time is: 9:33:41.95

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!

spyaxe uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

logfiles


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 792 'explorer.exe'
Killing PID 792 'explorer.exe'

Starting registry repairs

Deleting files


Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN!


Ewido Log:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:23:36 AM, 12/17/2005
+ Report-Checksum: E06FE637

+ Scan result:

C:\Documents and Settings\GothAdmin01\1.dat -> Downloader.Small.awa : Ignored
C:\WINDOWS\system32\winctrl64.exe -> Downloader.Small.awa : Ignored
C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip/Gummy.class -> Trojan.Java.Femad : Error during cleaning
C:\WINDOWS\system32\run894.exe -> Downloader.Small.cat : Cleaned with backup
C:\WINDOWS\system32\srpcsrv32.dll -> Downloader.Adload.g : Cleaned with backup
C:\WINDOWS\system32\txfdb32.dll -> Downloader.Adload.g : Cleaned with backup
C:\WINDOWS\system32\upd282.exe -> Downloader.Small.bgv : Cleaned with backup
C:\WINDOWS\system32\upd329.exe -> Dropper.Agent.ii : Cleaned with backup
C:\WINDOWS\system32\upd779.exe -> Downloader.Small.bpz : Cleaned with backup


::Report End

Thanks. should I remove all the files that Ewido found? There was also an error during the Sun\Java removal. Said that an entire file would have to be removed so I said no.

[Steamhead]

Hello bab,
You will want to print this out again.

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.

• Save it to your desktop.
• Please double-click Killbox.exe to run it.
• Select:
  • Delete on Reboot
  • then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\Documents and Settings\GothAdmin01\1.dat
  C:\WINDOWS\system32\winctrl64.exe
  C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip/Gummy.class
  C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip[Gummy.class]
  C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-1fbc98e-2f6e2d90.zip
  C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3f501a45-796c5803.zip
  C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-792a4b01-48a62f81.zip
  C:\WINDOWS\system32\ldr101.dll
  C:\WINDOWS\system32\ldr130.dll
  C:\WINDOWS\system32\ldr131.dll
  C:\WINDOWS\system32\ldr141.dll
  C:\WINDOWS\system32\ldr163.dll
  C:\WINDOWS\system32\ldr17.dll
  C:\WINDOWS\system32\ldr201.dll
  C:\WINDOWS\system32\ldr223.dll
  C:\WINDOWS\system32\ldr234.dll
  C:\WINDOWS\system32\ldr272.dll
  C:\WINDOWS\system32\ldr292.dll
  C:\WINDOWS\system32\ldr305.dll
  C:\WINDOWS\system32\ldr322.dll
  C:\WINDOWS\system32\ldr324.dll
  C:\WINDOWS\system32\ldr335.dll
  C:\WINDOWS\system32\ldr336.dll
  C:\WINDOWS\system32\ldr345.dll
  C:\WINDOWS\system32\ldr354.dll
  C:\WINDOWS\system32\ldr377.dll
  C:\WINDOWS\system32\ldr39.dll
  C:\WINDOWS\system32\ldr406.dll
  C:\WINDOWS\system32\ldr413.dll
  C:\WINDOWS\system32\ldr429.dll
  C:\WINDOWS\system32\ldr446.dll
  C:\WINDOWS\system32\ldr46.dll
  C:\WINDOWS\system32\ldr486.dll
  C:\WINDOWS\system32\ldr517.dll
  C:\WINDOWS\system32\ldr56.dll
  C:\WINDOWS\system32\ldr568.dll
  C:\WINDOWS\system32\ldr574.dll
  C:\WINDOWS\system32\ldr589.dll
  C:\WINDOWS\system32\ldr608.dll
  C:\WINDOWS\system32\ldr619.dll
  C:\WINDOWS\system32\ldr630.dll
  C:\WINDOWS\system32\ldr662.dll
  C:\WINDOWS\system32\ldr670.dll
  C:\WINDOWS\system32\ldr730.dll
  C:\WINDOWS\system32\ldr731.dll
  C:\WINDOWS\system32\ldr755.dll
  C:\WINDOWS\system32\ldr76.dll
  C:\WINDOWS\system32\ldr763.dll
  C:\WINDOWS\system32\ldr785.dll
  C:\WINDOWS\system32\ldr796.dll
  C:\WINDOWS\system32\ldr815.dll
  C:\WINDOWS\system32\ldr834.dll
  C:\WINDOWS\system32\ldr862.dll
  C:\WINDOWS\system32\ldr865.dll
  C:\WINDOWS\system32\ldr895.dll
  C:\WINDOWS\system32\ldr897.dll
  C:\WINDOWS\system32\ldr905.dll
  C:\WINDOWS\system32\ldr915.dll
  C:\WINDOWS\system32\ldr927.dll
  C:\WINDOWS\system32\ldr975.dll
  C:\WINDOWS\system32\ldr98.dll
  C:\WINDOWS\system32\ldr996.dll
  C:\WINDOWS\system32\msblank.html
  
  
  
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

[bab]

Ok, done. I did receive a "PendingfileRename Operations Registry Data has been Removed by External Precess" message. I clicked ok. After that message I did have to reboot manualy. Only received the one message. Did every thing still get deleted? Does this mean my system is clean? If so, THANK YOU!!

[Steamhead]

Hello ,
Unfortantly all of the "easy way out" methods are refusing to work, for some reason. This means we will have to get down and dirty and do this the long way. Fun fun.
Before we start, I would like you to compress and email some files to someone for me. This will help us find out why some tools didn't work. Thanks!

STEP 1:

• Please download WinZip 10.0 from here and save it to your desktop. (It is a trial version)
• Once finished, open the file you just downloaded and install WinZip 10.0.
• Open Windows Explorer and find the following file:
  C:\WINDOWS\system32\ldr101.dll
• Right click on that file and go to WinZip > Add to ldr101.dll You may get a screen pop up asking you to buy it, just click "Use Evaluation Version"
• You will notice a new file has been created in that folder called "ldr101" with a different icon.
• Repeat this with the following files.
  C:\WINDOWS\system32\ldr130.dll
  C:\WINDOWS\system32\ldr131.dll
  C:\WINDOWS\system32\ldr141.dll
  C:\WINDOWS\system32\ldr163.dll
  
• Now I need you to attch these new files to a e-mail and email it to submit @ atribune.org. Thanks!

STEP 2:


This is the hard part. Reboot into Safe Mode via tapping F8 as your computer is starting up, then selecting Safe Mode" from the menu and pressing Enter.

Open Explorer via right clicking on Start then clicking Explore.

Find and delete the following files.

C:\Documents and Settings\GothAdmin01\1.dat
C:\WINDOWS\system32\winctrl64.exe
C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip
C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip
C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-1fbc98e-2f6e2d90.zip
C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3f501a45-796c5803.zip
C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-792a4b01-48a62f81.zip
C:\WINDOWS\system32\ldr101.dll
C:\WINDOWS\system32\ldr130.dll
C:\WINDOWS\system32\ldr131.dll
C:\WINDOWS\system32\ldr141.dll
C:\WINDOWS\system32\ldr163.dll
C:\WINDOWS\system32\ldr17.dll
C:\WINDOWS\system32\ldr201.dll
C:\WINDOWS\system32\ldr223.dll
C:\WINDOWS\system32\ldr234.dll
C:\WINDOWS\system32\ldr272.dll
C:\WINDOWS\system32\ldr292.dll
C:\WINDOWS\system32\ldr305.dll
C:\WINDOWS\system32\ldr322.dll
C:\WINDOWS\system32\ldr324.dll
C:\WINDOWS\system32\ldr335.dll
C:\WINDOWS\system32\ldr336.dll
C:\WINDOWS\system32\ldr345.dll
C:\WINDOWS\system32\ldr354.dll
C:\WINDOWS\system32\ldr377.dll
C:\WINDOWS\system32\ldr39.dll
C:\WINDOWS\system32\ldr406.dll
C:\WINDOWS\system32\ldr413.dll
C:\WINDOWS\system32\ldr429.dll
C:\WINDOWS\system32\ldr446.dll
C:\WINDOWS\system32\ldr46.dll
C:\WINDOWS\system32\ldr486.dll
C:\WINDOWS\system32\ldr517.dll
C:\WINDOWS\system32\ldr56.dll
C:\WINDOWS\system32\ldr568.dll
C:\WINDOWS\system32\ldr574.dll
C:\WINDOWS\system32\ldr589.dll
C:\WINDOWS\system32\ldr608.dll
C:\WINDOWS\system32\ldr619.dll
C:\WINDOWS\system32\ldr630.dll
C:\WINDOWS\system32\ldr662.dll
C:\WINDOWS\system32\ldr670.dll
C:\WINDOWS\system32\ldr730.dll
C:\WINDOWS\system32\ldr731.dll
C:\WINDOWS\system32\ldr755.dll
C:\WINDOWS\system32\ldr76.dll
C:\WINDOWS\system32\ldr763.dll
C:\WINDOWS\system32\ldr785.dll
C:\WINDOWS\system32\ldr796.dll
C:\WINDOWS\system32\ldr815.dll
C:\WINDOWS\system32\ldr834.dll
C:\WINDOWS\system32\ldr862.dll
C:\WINDOWS\system32\ldr865.dll
C:\WINDOWS\system32\ldr895.dll
C:\WINDOWS\system32\ldr897.dll
C:\WINDOWS\system32\ldr905.dll
C:\WINDOWS\system32\ldr915.dll
C:\WINDOWS\system32\ldr927.dll
C:\WINDOWS\system32\ldr975.dll
C:\WINDOWS\system32\ldr98.dll
C:\WINDOWS\system32\ldr996.dll
C:\WINDOWS\system32\msblank.html

Phew! Finally done! Now I would like to see another panda ActiveScan. Thanks!

[bab]

Alright, check this out. Tried searching for all of the .dll files you listed. Couldnt find one. Tried searching in explorer and even tried typing in the exact address for the file. No sign anywhere. Good right? I did however find just one file on the entire list you gave me.
That was C:\Documents and Settings\GothAdmin01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5f21fc27-75c4ede6.zip.
I manualy deleted that file in safe mode. Also, that file was noted twice on your reply. It only showed once on my computer. No other files were found. Again searched and manualy typed address in Explorer. No such files existed.

I thinks this is good right?

I do have some questions. While searching for the Java files, even though I could not find the .zip files you asked for, there were 3 .idx files that had those titles (meaning the name of the file was the same as the .zip file you asked for but it was a .idx file). These are located in the same folder that I found the one .zip file you asked me to delete. I did nothing with the .idx files but wanted to tell you they were there. Hope that makes sense.

Finaly, Active Scan shows 3 infected files and 56 spyware. All are located in the Killbox file on my c: drive. Can I delete this file?


Also, noticed that C:\documents and Settings\GothAdmin01\1.dat is not there. Its gone. However there is a C:\documents and Settings\GothAdmin01\2.dat file. It was created Dec 11, 2005. Should I delete this file as well? I have no idea what it is.

Thanks for everything.


Active Scan:

ncident Status Location

Virus:Exploit/ByteVerify Not disinfected C:\!KillBox\archive.jar-1fbc98e-2f6e2d90.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\!KillBox\archive.jar-3f501a45-796c5803.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\!KillBox\archive.jar-792a4b01-48a62f81.zip[Dummy.class]
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr101.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr130.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr131.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr141.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr163.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr17.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr201.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr234.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr272.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr292.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr305.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr322.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr324.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr335.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr336.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr345.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr354.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr377.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr39.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr406.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr413.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr429.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr446.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr46.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr486.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr517.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr56.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr568.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr574.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr589.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr608.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr619.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr630.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr662.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr670.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr730.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr731.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr755.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr76.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr763.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr785.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr796.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr815.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr834.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr862.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr865.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr895.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr897.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr905.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr915.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr927.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr975.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr98.dll
Adware:Adware/WinHound Not disinfected C:\!KillBox\ldr996.dll

Edited by bab, 20 December 2005 - 12:33 AM.

[Steamhead]

Hello bab,

Yes, the files ending up in the !Killbox folder is a good thing, and they are now harmless. All the files you found are fine too.

Also, please attempt to submit those files using the instructions provided earlier, except in the !Killbox file.

Now I am glad to announce that you are CLEAN!

The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

• Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.
  
• AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
  
• SpywareBlaster - Great prevention tool to keep nasties from installing on your system.
  
• SpywareGuard - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.
  
• IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
  
• CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
• Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  
• Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.
  
• Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
• Weather Watcher - Free taskbar weather program that is free, malware free, and resource light.

[therock247uk]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.